RTOS/CC3220S-LAUNCHXL: AWS IoT Certificate Unable to successfully connect

Please find attached my cert.h file. (don't care if the private key is in there b/c once it's all working I could always regen a new certificate anyway). Screenshot shows the certificate is active.

For what it's worth, WinGPG and Kleopatra imports the certificate but says it's not certified.

certs.h

I don't know if it should work, but AWS won't allow you to register the certificate they generated.

Hi,

Well, yes, I'm pretty sure. I flashed the CC3220 blank and then I flashed with the

C:\ti\simplelink_cc32xx_sdk_1_50_00_06\examples\rtos\CC3220S_LAUNCHXL\demos\out_of_box\uniflash\OOB_RS_tirtos.zip from the sdk as you can see. I set the Trusted Root-Certificate Catalog from certificate-catalog file and the signature source file from same directoy (see image, and the service pack).

The readme says the list includes

"VeriSign Class 3 Public Primary Certification Authority - G5" and this is the same authority that issued the AWS Root Certificate.

The thing is the AWS-IoT certificate that is issued for use with MQTT doesn't seem to have any valid issuing path, so I'm pretty sure having the AWS root certificate around is meaningless since the AWS-IoT certificate can't chain to it anyway.

The simplelink socket code may work with a valid certificate chain but the certificates being issued by AWS-IOT aren't certified. So I think it's a lost cause in the case that people are trying to use those certificates in this sample code. If the sample code is assuming the certificates are certified then it will always fail with the aforementioned error.

$ openssl verify af02dc3615-certificate.pem.crt
af02dc3615-certificate.pem.crt: C = US, ST = CA, L = San Francisco, O = Karl Nicholas, OU = Self, CN = 6abf887188407c736bad2a563d8d03cebe5bd0d1c64ae3f97e56b89e23988588, emailAddress = XXX
error 20 at 0 depth lookup:unable to get local issuer certificate

Hi Eugene,

You can see earlier in this thread that I'm getting the certificates from the AWS IoT console, client and private key generated, root ca just downloaded.

Is your MQTT endpoint in US-EAST or US-WEST? Mine's on US-WEST-2. I saw on some github threads some conversation about this and AWS seemed to say it made a difference.

Otherwise, I'd be happy to try to connect to an endpoint and certificate that you have that works, or visa versa if you want. I can send you my certificate and a screen-shot showing it's activated. Don't use the ones posted earlier in this thread because I have revoked them, but it's easy enough to create new ones or send you the one I'm trying at the moment.

I'm really not doing anything fancy that I can tell.

Michael, see thread on  CC3220SF-LAUNCHXL: AWS IoT Error -24 for code workaround.

Hi Karl,

It sounds like you have configured your board to boot your application from flash. Is that correct?

If that's correct, I'm wondering if you are able to run the Shadow example when you don't boot from flash? I.e. just load and run it via CCS, using the certificates that you get from Amazon and with the cert store option check box *checked*

Steve

Hi Karl,

Not sure, that I could help you with it too much, because I use CC3120 and UniFlash to flash everything. It has an option to upload new service pack and root ca list files.

I had to upload a code signing certificate when used secure file system. When you upload some file and mark it as "secure" you need to provide a valid signature or a private key (in second case Uniflash can generate the file signature by itself). If you'll obtain a code signing certificate, check this my thread, I had some troubles with it:

Best regards,

Eugene.

Hi Karl,

Can you please try the following steps and let me know if they allow you to run the Shadow Example from CCS?

1. Using Uniflash, configure the default cert store: .

Disconnect from Uniflash. Please make sure that your board is disconnected from CCS and powered down.

(Note that the details of the below steps can be found in the AWS Quick Start Guide, sections "Building and running Examples in CCS" and "Example Pre-Build Steps")

1. power the CC3220 back on and connect it to a terminal for program output.
2. import the Shadow Example into CCS
3. edit the file "aws_iot_config.h"
   
   1. update the macros with the proper account info for your device, as found in the AWS console when you log in.
4. edit the "certs.h" file
   1. update the file with the content of the certs you downloaded from Amazon
5. edit the wificonfig.h file
   1. update the macros with the SSID and password of your access point
6. click the "debug" button to build the project, launch the CC3220 and load the app
7. run

(Again, the full details of the above steps are found in the AWS Quick Start Guide. Please refer to that in addition to the above).

Are you able to run successfully?

Steve

Hi Eugene,

I tested the connection manually with openssl   -->  

openssl s_client -connect a3joj5u9gv9t8f.iot.us-east-1.amazonaws.com:8883 -CAfile aws-root-ca.pem.crt -cert 545acc1c00-certificate.pem.crt -key 545acc1c00-private.pem.key

And it seems to authenticate and connect and it's all happy as far as I can tell.

So, yea, I think you're correct. All these comments about flashing and certstores don't mean anything. 

Hi,

I am able to reproduce the problem with very straightforward simplelink only code. Is this an issue that has been fixed in more recent versions of CC3220? Is it possible to compare versions of the firmware or somehow flash an update the simplelink network processor?

I am able to test the client connection and certificate from AWS with openssl.

$ openssl s_client -connect iot.us-west-2.amazonaws.com:443 -CAfile aws-root-ca.pem.crt -cert 545acc1c00-certificate.pem.crt  -key 545acc1c00-private.pem.key
CONNECTED(00000003)
depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5
verify return:1
depth=1 C = US, O = Symantec Corporation, OU = Symantec Trust Network, CN = Symantec Class 3 Secure Server CA - G4
verify return:1
depth=0 C = US, ST = Washington, L = Seattle, O = "Amazon.com, Inc.", CN = iot.us-west-2.amazonaws.com
verify return:1
---
Certificate chain
 0 s:/C=US/ST=Washington/L=Seattle/O=Amazon.com, Inc./CN=iot.us-west-2.amazonaws.com
   i:/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 Secure Server CA - G4
 1 s:/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 Secure Server CA - G4
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5

and the code

//*****************************************************************************
// includes
//*****************************************************************************
#include <stdlib.h>

/* TI-DRIVERS Header files */
#include <ti/display/Display.h>
#include <ti/drivers/net/wifi/simplelink.h>
#include "uart_term.h"

//****************************************************************************
//                      LOCAL FUNCTION PROTOTYPES
//****************************************************************************

#define AWS_IOT_MQTT_HOST              "a3joj5u9gv9t8f.iot.us-east-1.amazonaws.com" ///< Customer specific MQTT HOST. The same will be used for Thing Shadow
#define AWS_IOT_MQTT_PORT              8883 ///< default port for MQTT/S

#define AWS_IOT_ROOT_CA_FILENAME       "/cert/root-ca.crt" ///< Root CA file name
#define AWS_IOT_CERTIFICATE_FILENAME   "/cert/545acc1c00-certificate.crt" ///< device signed certificate file name
#define AWS_IOT_PRIVATE_KEY_FILENAME   "/cert/545acc1c00-private.key" ///< Device private key filename

extern void NetWiFi_init();
extern Display_Handle AWSIOT_display;


//*****************************************************************************
//
//! mainThread
//!
//!  \param  pvParameters
//!
//!  \return none
//!
//!  \brief Task handler
//
//*****************************************************************************

void *manualMainThread(void *arg0)
{
    int32_t     status = -1;
    _u32 DestinationIP;
    SlSockAddrIn_t Addr;

    /* Initialize SimpleLink */
    NetWiFi_init();

    status = sl_NetAppDnsGetHostByName(AWS_IOT_MQTT_HOST, strlen(AWS_IOT_MQTT_HOST), &DestinationIP, SL_AF_INET);
    if ( status < 0 ) {
        Display_printf(AWSIOT_display, 0, 0, "sl_NetAppDnsGetHostByName fail: %d\n", status);
        return (NULL);
    }

    _i16 sHandle = sl_Socket(SL_AF_INET, SL_SOCK_STREAM, SL_SEC_SOCKET);
    if ( sHandle < 0 ) {
        Display_printf(AWSIOT_display, 0, 0, "sl_Socket fail: %d\n", status);
        return (NULL);
    }

    _u8 *pSecMethod;
    pSecMethod = malloc(sizeof(_u8));
    *pSecMethod = SL_SO_SEC_METHOD_SSLv3_TLSV1_2;
//    *pSecMethod = SL_SO_SEC_METHOD_TLSV1_2;

    status = sl_SetSockOpt(sHandle, SL_SOL_SOCKET, SL_SO_SECMETHOD, pSecMethod, sizeof(_u8));
    if ( status < 0 ) {
        Display_printf(AWSIOT_display, 0, 0, "sl_SetSockOpt SL_SO_SECMETHOD fail: %d\n", status);
        return (NULL);
    }

    status = sl_SetSockOpt(sHandle, SL_SOL_SOCKET, SL_SO_SECURE_FILES_CA_FILE_NAME,
               &AWS_IOT_ROOT_CA_FILENAME, strlen(AWS_IOT_ROOT_CA_FILENAME));
    if ( status < 0 ) {
        Display_printf(AWSIOT_display, 0, 0, "sl_SetSockOpt SL_SO_SECURE_FILES_CA_FILE_NAME fail: %d\n", status);
        return (NULL);
    }

    status = sl_SetSockOpt(sHandle, SL_SOL_SOCKET, SL_SO_SECURE_FILES_CERTIFICATE_FILE_NAME,
                           &AWS_IOT_CERTIFICATE_FILENAME, strlen(AWS_IOT_CERTIFICATE_FILENAME));
    if ( status < 0 ) {
        Display_printf(AWSIOT_display, 0, 0, "sl_SetSockOpt SL_SO_SECURE_FILES_CERTIFICATE_FILE_NAME fail: %d\n", status);
        return (NULL);
    }

    status = sl_SetSockOpt(sHandle, SL_SOL_SOCKET, SL_SO_SECURE_FILES_PRIVATE_KEY_FILE_NAME,
                       &AWS_IOT_PRIVATE_KEY_FILENAME, strlen(AWS_IOT_PRIVATE_KEY_FILENAME));
    if ( status < 0 ) {
        Display_printf(AWSIOT_display, 0, 0, "sl_SetSockOpt SL_SO_SECURE_FILES_PRIVATE_KEY_FILE_NAME fail: %d\n", status);
        return (NULL);
    }

    Addr.sin_family = SL_AF_INET;
    Addr.sin_port = sl_Htons(AWS_IOT_MQTT_PORT);
    Addr.sin_addr.s_addr = sl_Htonl(DestinationIP);

    // get a -468 here.
    status = sl_Connect(sHandle, (const SlSockAddr_t *)&Addr, sizeof(Addr));
    if ( status < 0 ) {
        Display_printf(AWSIOT_display, 0, 0, "sl_Connect fail: %d\n", status);
        return (NULL);
    }

    status = sl_Close(sHandle);
    if ( status < 0 ) {
        Display_printf(AWSIOT_display, 0, 0, "sl_Close fail: %d\n", status);
        return (NULL);
    }
    Display_printf(AWSIOT_display, 0, 0, "CC3220 has socket success.\n");

    return (NULL);
}